CVE-2013-4221

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

• CWE-16
• CWE-91

• http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.htmlThird Party Advisory
• http://restlet.org/learn/2.1/changesRelease Notes, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=995275Issue Tracking, Third Party Advisory
• https://github.com/restlet/restlet-framework-java/issues/774Issue Tracking, Patch
• http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.htmlThird Party Advisory
• http://restlet.org/learn/2.1/changesRelease Notes, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1410.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1862.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=995275Issue Tracking, Third Party Advisory
• https://github.com/restlet/restlet-framework-java/issues/774Issue Tracking, Patch

Published

Oct 10, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4215The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plu…
• CVE-2013-4216The Trace_OpenLogFile function in InfraStack/OSDependent/Lin…
• CVE-2013-4217The OSAL_Crypt_SetEncryptedPassword function in InfraStack/O…
• CVE-2013-4218The InitMethodAndPassword function in InfraStack/OSAgnostic/…
• CVE-2013-4219Multiple integer overflows in the Intel WiMAX Network Servic…
• CVE-2013-4220The bad_mode function in arch/arm64/kernel/traps.c in the Li…
• CVE-2013-4222OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and e…
• CVE-2013-4223The Gentoo Nullmailer package before 1.11-r2 uses world-read…
• CVE-2013-4224Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4225The RESTful Web Services (restws) module 7.x-1.x before 7.x-…8.8
• CVE-2013-4226The Authenticated User Page Caching (Authcache) module 7.x-1…6.5
• CVE-2013-4227Cross-site request forgery (CSRF) vulnerability in the perso…8.8